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(c) 
(d) 
(e) 
(f) 
(g) 
(h) 
(i) 



A method for policy-based billing for a network session, comprising: 
receiving a plurality of packets at a plurality of analyzers; 
aggregating the plurality of packets; 

analyzing the plurality of packets to identify a plurality of^Tows; 
identifying a session associated with the flows; 
identifying at least one application associated with ifre session; 
reconstructing the session utilizing the identifies application; 
identifying a user associated with the sessiojrf 
determining a policy; and 

billing the user for the session in accordance with the policy. 



21 . The method as recited in claim 20, and further comprising filtering the packets for 
removing packets unrelated to the session. 

22. The method as recited in/laim 20, and further comprising identifying application 
events associated with the session based on the policy. 
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23. The method as redxed in claim 22, and further comprising assigning a significance 
to the application event/based on the policy. 

24. The method/as recited in claim 22, wherein the user is billed for the session 
utilizing the application events in accordance with the policy. 

25. The method as recited in claim 22, and further comprising determining billing 
information for the session using the application events in accordance with the policy. 

26. The method as recited in claim 25, and further comprising outputting a report 
including the billing information in accordance with the policy. 



27. / The method as recited in claim 20, and further comprising restricting tasks of the 
user m accordance with the policy. 
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28. The method as recited in claim 27, wherein an amount of bandwidth is restricted 
in accordance with the policy. / 

29. The method as recited in claim 20, wherein the policy include^ series of packet 
capture language expressions and output selectors. / 

30. A computer program product for policy-based biltirfg for a network session, 
comprising: / 

(a) computer code for receiving a plurality of packets at a plurality of analyzers; 

(b) computer code for aggregating the plurality of packets; 

(c) computer code for analyzing the plurality of packets to identify a plurality of 
flows; / 

(d) computer code for identifying dl session associated with the flows; 

(e) computer code for identifying at least one application associated with the session; 

(f) computer code for reconstructing the session utilizing the identified application; 

(g) computer code for identifying a user associated with the session; 

(h) computer code for determining a policy; and 

(i) computer code for/oilling the user for the session in accordance with the policy. 

3 1 . The computer/program product as recited in claim 30, and further comprising 
computer code for filtering the packets for removing packets unrelated to the session. 

32. The computer program product as recited in claim 30, and further comprising 
computer code/for identifying application events associated with the session based on the 
policy. / 

33. The computer program product as recited in claim 32, and further comprising 
computerycode for assigning a significance to the application events based on the policy. 
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34. The computer program product as recited in claim 32, wherekktlie user is billed 
for the session utilizing the application events in accordance witjyfhe policy. 

35. The computer program product as recited in clairrf 32, and further comprising 
computer code for determining billing information fpr the session using the application 
events in accordance with the policy. 

36. The computer program product as recited in claim 35, and further comprising 
computer code for outputting a report including the billing information in accordance 
with the policy. 

37. The computer program product as recited in claim 30, and further comprising 
computer code for restricting tasp of the user in accordance with the policy. 

38. The computer program product as recited in claim 37, wherein an amount of 
bandwidth is restricted in accordance with the policy. 

39. The computer program product as recited in claim 30, wherein the policy includes 
a series of packet capture language expressions and output selectors. 

40. A method for policy-based billing for a network session, comprising: 

(a) receiving amlurality of packets at a plurality of analyzers; 

(b) aggregating the plurality of packets; 

(c) analyzing the plurality of packets to identify at least a first flow; 

(d) identifying a session associated with the first flow; 

(e) identifying additional flows in the plurality of packets associated with the session; 

(f) filtering the packets for removing packets unrelated to the session; 

(g) identifying at least one application associated with the session; 

(h) reconstructing the session utilizing the identified application; 

(i) identifying a user associated with the session; 
(j) identifying a policy; 
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